Download
1.4MB/s
Upload
320KB/s
Peak ↓
4.8MB/s
Connections
3
Transferred
214MB
Open for
12:04
Bind a local port and Jump Hippo opens the SSH tunnel the moment you use it — through a chain of jump hosts if you need them — holds it open while traffic flows, and tears it down once the port goes idle. Pause any tunnel without losing it.
macOS · Windows · Linux · Free & open source
Features
Built for anyone who reaches databases, dashboards, and internal services over SSH. Fast, keyboard-friendly, security-first, and fully offline.
The SSH session stays closed until something actually touches the local port. First byte in, Jump Hippo dials the connection — the listener itself is always bound and ready.
When the last connection closes and the port goes quiet, the SSH session is torn down automatically — no lingering sessions or wasted sockets. The listener stays bound, ready to reconnect.
Reach hosts you can't hit directly. Chain any number of bastions and jump hosts; Jump Hippo hops through them in order and forwards to the final destination.
Pause a tunnel to drop its live SSH session without deleting the definition. Resume any time — the port stays bound and reconnects on the next request.
Watch live upload/download rates, peaks and averages, byte totals, connection counts, and uptime update in real time — as drag-and-drop cards you arrange yourself or a sortable table. Pick exactly which metrics each view shows.
Authenticate each hop with a password or an SSH private key and passphrase. Secrets are encrypted at rest, and the UI never sees a decrypted credential.
Every SSH host is checked against known_hosts. First contact prompts for explicit trust — Jump Hippo never silently accepts an unknown key.
Listeners bind to 127.0.0.1 out of the box — reachable only from your own machine. Exposing a tunnel to your LAN is a deliberate opt-in: you enter an explicit address:port, never the default.
Forward however you need: classic local forwards, reverse forwards that expose a service from your side, and dynamic forwarding that turns a tunnel into a SOCKS5 proxy — same on-demand lifecycle for all three.
Choose how secrets are stored at rest: a promptless device key, your OS keychain, or a master password (PBKDF2 → AES-256-GCM, held only in memory). Switching backends re-encrypts everything at once — and no mode ever downgrades a secret to plaintext.
Sort tunnels into colour-coded, collapsible groups — Work, Home lab, whatever fits. Arm, disarm, or pause an entire group in one click from its header, the tray, or the menu. Ungrouped tunnels stay first-class.
Native builds for macOS, Windows, and Linux on both arm64 and x64 — signed and notarized where the platform supports it, with non-forced in-app auto-update.
Downloads
Version 0.6.0 — free to download and use. No account required.
Recent releases